Security Policy
Committed to Safety
We take the security of Soplang seriously. This policy outlines how to report vulnerabilities and our commitment to addressing security issues.
Reporting a Vulnerability
Do not report security vulnerabilities through public GitHub issues or community forums.
Please report security vulnerabilities by emailing our security team directly. We will acknowledge your email within 48 hours.
security@soplang.orgWhat to include
- Type of vulnerability
- Path or location of the vulnerable code
- Step-by-step instructions to reproduce
- Explanation of potential impacts
- Suggested fix (if available)
Disclosure Policy
When we receive a report, we will:
- Confirm scope and vulnerability
- Develop and test a fix
- Release update and credit reporter
We typically address critical issues within 7-14 days.
Security Best Practices
- Keep Soplang updated to the latest version
- Validate all user inputs cautiously
- Regularly review your dependencies
- Use scanners to identify vulnerabilities
Bug Bounty
We don't have a formal program yet, but we credit all reporters in our security releases.